CVE-2025-67269

highpriority · track · 0EPSS 0.006 · 47 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.56% (47th) EPSS

CVSS 7.5 · high

Is it mine?

25 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedgpsd-1:3.26.1-1.el10_1.1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-clients-1:3.26.1-1.el10_1.1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython3-gpsd-1:3.26.1-1.el10_1.1.x86_64 as component of SUSE Liberty Linux 10suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-minimal-1:3.26.1-1.el9_7.1.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-minimal-clients-1:3.26.1-1.el9_7.1.x86_64 as component of SUSE Liberty Linux 9suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-clients-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-clients-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-clients-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-clients-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-devel-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-devel-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-devel-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-devel-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-qt6-devel-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-qt6-devel-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-qt6-devel-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgpsd-qt6-devel-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedlibQgpsmm32-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedlibQgpsmm32-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedlibQgpsmm32-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedlibQgpsmm32-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibgps32-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibgps32-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibgps32-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedlibgps32-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython3-gpsd-0:3.27.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython3-gpsd-0:3.27.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython3-gpsd-0:3.27.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedpython3-gpsd-0:3.27.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-191USCWE-191US

affected products (25)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux 10all versionscert_bundDEcpe:/o:redhat:enterprise_linux:10
Red Hat Enterprise Linux 9all versionscert_bundDEcpe:/o:redhat:enterprise_linux:9
n/a n/a≤ n/aenisa_euvdEU
Canonical Ltd. Ubuntu≤ 26.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 22.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 24.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 25.10fstec_bduRU
Eric S. Raymond GPSd≤ 3.27.1fstec_bduRU
Fedora Project Fedora≤ 43fstec_bduRU
Fedora Project Fedora≤ 42fstec_bduRU
Fedora Project Fedora EPEL≤ epel8fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 10fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
ООО "Открытая мобильная платформа" ОС Аврора≤ 5.2.1fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.8fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU

showing 20 of 25

advisories (4)

Vendor and ecosystem advisories describing this.

RHSA-2026:0770security update for gpsd2026-01-19csaf · suse_csafDE
security update for gpsd
RHSA-2026:0771security update for gpsd-minimal2026-01-19csaf · suse_csafDE
security update for gpsd-minimal
WID-SEC-W-2026-0138Red Hat Enterprise Linux (gpsd): Mehrere SchwachstellenDeutsch2026-01-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand zu verursachen.
openSUSE-SU-2026:10008-1gpsd-3.27.3-1.1 on GA media2026-01-06csaf · suse_csafDE
gpsd-3.27.3-1.1 on GA media

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund suse_csaf NVD CVE.org MITRE

published 2026-01-02modified 2026-07-15

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan